4 ms·
Then how does the image consistently display before the password has been provided? No matter what the answer is, I don't see how it could be an anti-phishing
by agwa 10y ago
Then how does the image consistently display before the password has been provided? No matter what the answer is, I don't see how it could be an anti-phishing feature.
- minimaxir 10y agoGoogle naturally has their own private APIs which will only show the profile image for legitimate logins.
- lucb1e 10y agoAnd no phisher has ever copied anything from the original site before.
- gog 10y agoBecause the image location is stored in a cookie from before the attack and this cookie will not be sent by a browser to a phishing site. Try from the incognito windows in your browser the image should not show up since no cookies are being sent in the incognito window.
- zaroth 10y agoI use fresh incognito tabs constantly. So I guess I'll never see the image, and never know something is amiss. By I also never click an email link to login unless it's a plain text password reset. I receive authentic looking and topical Dropbox share requests from actual contacts (who have been hacked) trying to phish my Dropbox credentials maybe 4-5 times a year so I'm always on the lookout for it. This is a classic attack. Always check the URL!